decoder/dsdiff: reject overflowing chunk offsets - #2553
Open
acts-1631 wants to merge 1 commit into
Open
Conversation
| uint64_t GetPaddedSize() const noexcept { | ||
| return (GetSize() + 1) & ~uint64_t(1); | ||
| [[nodiscard]] | ||
| bool GetPaddedSize(uint64_t &padded_size) const noexcept { |
Member
There was a problem hiding this comment.
This is horribly inelegant code and it's no longer obvious what this function really does. This needs API documentation. But probably it needs a rewrite to make it easier to understand. This whole PR looks like LLM slop.
DSDIFF chunk sizes are read from untrusted files. Adding a size to the current offset can wrap and seek back to the same chunk header. Metadata scans then loop forever, while playback spins until stopped. Reject additions that exceed offset_type before seeking. Also reject overflow while applying DSDIFF padding and relative skips.
acts-1631
force-pushed
the
fix/dsdiff-chunk-overflow
branch
from
August 2, 2026 13:06
77093d6 to
7b5036d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
dsdiff_read_metadata() reads a 64-bit chunk size from the DFF file and
adds it to the current input offset. If this addition overflows, the
result can point backward. For seekable input, dsdlib_skip_to() then
seeks back to the same chunk header, causing metadata scans to loop
indefinitely. Playback follows the same parsing path and can spin until
stopped.
Use checked offset addition in dsdiff_read_metadata(),
dsdiff_read_prop(), and dsdiff_read_prop_snd(). Also reject overflow
when applying DSDIFF even-byte padding and in dsdlib_skip() relative
seeks. Absolute backward seeks remain supported because the tag reader
uses them intentionally.
Verified with a 28-byte DFF file whose unknown chunk size wraps the
offset from 28 back to 16. The checked calculation now rejects the
chunk.